CVE-2009-3954: Code Injection
Published Jan 12, 2010
·Updated
The 3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, might allow attackers to execute arbitrary code via unspecified vectors, related to a "DLL-loading vulnerability."
Affected Software
102 affected componentsFixes available
redhat/acroread<0:9.3-1.el4
0:9.3-1.el4
redhat/acroread<0:9.3-1.el5
0:9.3-1.el5
Adobe Acrobat<=9.2
Adobe Acrobat=3.0
Adobe Acrobat=3.1
Adobe Acrobat=4.0
Adobe Acrobat=4.0.5
Adobe Acrobat=4.0.5a
Adobe Acrobat=4.0.5c
Adobe Acrobat=5.0
Adobe Acrobat=5.0.5
Adobe Acrobat=5.0.6
Adobe Acrobat=5.0.10
Adobe Acrobat=6.0
Adobe Acrobat=6.0.1
Adobe Acrobat=6.0.2
Adobe Acrobat=6.0.3
Adobe Acrobat=6.0.4
Adobe Acrobat=6.0.5
Adobe Acrobat=6.0.6
Adobe Acrobat=7.0
Adobe Acrobat=7.0.1
Adobe Acrobat=7.0.2
Adobe Acrobat=7.0.3
Adobe Acrobat=7.0.4
Adobe Acrobat=7.0.5
Adobe Acrobat=7.0.6
Adobe Acrobat=7.0.7
Adobe Acrobat=7.0.8
Adobe Acrobat=7.0.9
Adobe Acrobat=7.1.0
Adobe Acrobat=7.1.1
Adobe Acrobat=7.1.2
Adobe Acrobat=7.1.3
Adobe Acrobat=7.1.4
Adobe Acrobat=8.0
Adobe Acrobat=8.1
Adobe Acrobat=8.1.1
Adobe Acrobat=8.1.2
Adobe Acrobat=8.1.3
Adobe Acrobat=8.1.4
Adobe Acrobat=8.1.5
Adobe Acrobat=8.1.6
Adobe Acrobat=8.1.7
Adobe Acrobat=9.0
Adobe Acrobat=9.1
Adobe Acrobat=9.1.1
Adobe Acrobat=9.1.2
Adobe Acrobat=9.1.3
Apple iOS and macOS
Microsoft Windows
Adobe Acrobat Reader<=9.2
Adobe Acrobat Reader=3.0
Adobe Acrobat Reader=3.01
Adobe Acrobat Reader=3.02
Adobe Acrobat Reader=4.0
Adobe Acrobat Reader=4.0.5
Adobe Acrobat Reader=4.0.5a
Adobe Acrobat Reader=4.0.5c
Adobe Acrobat Reader=4.5
Adobe Acrobat Reader=5.0
Adobe Acrobat Reader=5.0.5
Adobe Acrobat Reader=5.0.6
Adobe Acrobat Reader=5.0.7
Adobe Acrobat Reader=5.0.9
Adobe Acrobat Reader=5.0.10
Adobe Acrobat Reader=5.0.11
Adobe Acrobat Reader=5.1
Adobe Acrobat Reader=6.0
Adobe Acrobat Reader=6.0.1
Adobe Acrobat Reader=6.0.2
Adobe Acrobat Reader=6.0.3
Adobe Acrobat Reader=6.0.4
Adobe Acrobat Reader=6.0.5
Adobe Acrobat Reader=7.0
Adobe Acrobat Reader=7.0.1
Adobe Acrobat Reader=7.0.2
Adobe Acrobat Reader=7.0.3
Adobe Acrobat Reader=7.0.4
Adobe Acrobat Reader=7.0.5
Adobe Acrobat Reader=7.0.6
Adobe Acrobat Reader=7.0.7
Adobe Acrobat Reader=7.0.8
Adobe Acrobat Reader=7.0.9
Adobe Acrobat Reader=7.1.0
Adobe Acrobat Reader=7.1.1
Adobe Acrobat Reader=7.1.2
Adobe Acrobat Reader=7.1.3
Adobe Acrobat Reader=8.0
Adobe Acrobat Reader=8.1
Adobe Acrobat Reader=8.1.1
Adobe Acrobat Reader=8.1.2
Adobe Acrobat Reader=8.1.4
Adobe Acrobat Reader=8.1.5
Adobe Acrobat Reader=8.1.6
Adobe Acrobat Reader=8.1.7
Adobe Acrobat Reader=9.0
Adobe Acrobat Reader=9.1
Adobe Acrobat Reader=9.1.1
Adobe Acrobat Reader=9.1.2
Adobe Acrobat Reader=9.1.3
Unix Unix
Remediation
Event History
Jan 12, 2010
CVE Published
via Red Hat·12:00 AM
Jan 13, 2010
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Data Sourced
07:30 PM
DescriptionWeaknessAffected Software
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
1
What is the severity of CVE-2009-3954?
The CVE-2009-3954 vulnerability is considered critical due to its potential to allow arbitrary code execution.
2
How do I fix CVE-2009-3954?
To mitigate CVE-2009-3954, upgrade Adobe Reader and Acrobat to version 9.3 or later.
3
What software is affected by CVE-2009-3954?
CVE-2009-3954 affects Adobe Reader and Acrobat versions 8.x prior to 8.2 and 9.x prior to 9.3 on Windows and Mac OS X.
4
Can CVE-2009-3954 be exploited remotely?
Yes, CVE-2009-3954 can be exploited remotely through specially crafted PDF files.
5
Is there a patch available for CVE-2009-3954?
Yes, Adobe has released patches for CVE-2009-3954 in versions 8.2 and 9.3.